Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-8051 | special-feed-items (WordPress plugin) | The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 5.4 | 0% |
| CVE-2026-49214 | guzzlehttp/psr7 | guzzlehttp/psr7 has CRLF Injection via URI Host Component | medium | 5.3 | 0% |
| CVE-2024-10634 | nokaut-offers-box (WordPress plugin) | The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-10677 | blue-trait-event-viewer (WordPress plugin) | The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a | medium | 4.3 | 0% |
| CVE-2024-11373 | connexion-logs (WordPress plugin) | The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2024-12750 | competition-form (WordPress plugin) | The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers | medium | 4.3 | 0% |
| CVE-2024-9233 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2026-84911 | drupal/ai | This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module | unknown | 0.0 | 0% |
| CVE-2024-8093 | posts-reminder (WordPress plugin) | The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers t | medium | 6.5 | 0% |
| CVE-2024-2969 | wp-eggdrop (WordPress plugin) | The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to mi | medium | 5.4 | 0% |
| CVE-2024-3407 | wp-prayer (WordPress plugin) | The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users p | medium | 5.3 | 0% |
| CVE-2026-114540 | drupal/domain | This module enables you to share users, content and configuration across a group of domains from a single Drupal install | unknown | 0.0 | 0% |
| CVE-2026-84910 | drupal/advanced_search | This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently | unknown | 0.0 | 0% |
| CVE-2025-67648 | shopware/shopware, shopware/storefront | Shopware Storefront Reflected XSS in Storefront Login Page | high | 7.1 | 0% |
| CVE-2026-31351 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module | medium | 4.8 | 0% |
| CVE-2025-1320 | teachpress (WordPress plugin) | The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to | medium | 4.3 | 0% |
| CVE-2026-4587 | hybridauth/hybridauth | HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client | low | 3.7 | 0% |
| CVE-2026-13236 | drupal/ai_agents | This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. The module does no | unknown | 0.0 | 0% |
| CVE-2026-3218 | drupal/responsive_favicons | This module adds the favicons generated by `realfavicongenerator.net` to your Drupal site. The module does not filter a | unknown | 0.0 | 0% |
| CVE-2026-84912 | drupal/ai | This submodule AI Translate enables you to automatically translate entities. The module doesn't sufficiently check acce | unknown | 0.0 | 0% |
| CVE-2026-84913 | drupal/ai_translate | This module enables you to automatically translate entities. The module doesn't sufficiently check access on the entity | unknown | 0.0 | 0% |
| CVE-2025-59015 | typo3/cms-core | TYPO3 CMS uses insufficient entropy when generating passwords | medium | 6.5 | 0% |
| CVE-2024-5081 | wp-emember (WordPress plugin) | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi | medium | 6.1 | 0% |
| CVE-2024-6017 | music-request-manager (WordPress plugin) | The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escap | medium | 6.1 | 0% |
| CVE-2024-7816 | gixaw-chat (WordPress plugin) | The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-7818 | misiek-photo-album (WordPress plugin) | The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escapi | medium | 6.1 | 0% |
| CVE-2024-7822 | quick-code (WordPress plugin) | The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which | medium | 6.1 | 0% |
| CVE-2024-7860 | simple-headline-rotator (WordPress plugin) | The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as esc | medium | 6.1 | 0% |
| CVE-2024-7861 | misiek-paypal (WordPress plugin) | The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as esca | medium | 6.1 | 0% |
| CVE-2024-10892 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to ma | medium | 5.4 | 0% |
| CVE-2026-46360 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS | medium | 5.4 | 0% |
| CVE-2026-46363 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization | medium | 5.4 | 0% |
| CVE-2024-7984 | joy-of-text (WordPress plugin) | The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attacke | medium | 4.3 | 0% |
| CVE-2024-8082 | widgets-reset (WordPress plugin) | The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to | medium | 4.3 | 0% |
| CVE-2024-8245 | gamipress---reset-user (WordPress plugin) | The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to ma | medium | 4.3 | 0% |
| CVE-2026-118557 | drupal/commerce_shipping | This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. | unknown | 0.0 | 0% |
| CVE-2026-118583 | drupal/field_permissions | This module enables you to set field-level permissions to create, update or view individual fields. The module does not | unknown | 0.0 | 0% |
| CVE-2026-118584 | drupal/field_permissions | The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Pri | unknown | 0.0 | 0% |
| CVE-2025-65621 | snipe/snipe-it | Snipe-IT is vulnerable to stored cross-site scripting | medium | 5.4 | 0% |
| CVE-2025-58758 | datahihi1/tiny-env | TinyEnv: Missing .env file not required — may cause unexpected behavior | medium | 5.1 | 0% |
| CVE-2025-0801 | ratemyagent-official (WordPress plugin) | The RateMyAgent Official plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This | medium | 4.3 | 0% |
| CVE-2025-12761 | drupal/simple_multistep | This module provides the ability to convert any entity form into a simple multi-step form. The module doesn’t sufficien | low | 3.5 | 0% |
| CVE-2026-118551 | drupal/ai | This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text | unknown | 0.0 | 0% |
| CVE-2024-2964 | pocket-news-generator (WordPress plugin) | The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This | medium | 5.4 | 0% |
| CVE-2024-4529 | business-card (WordPress plugin) | The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use | medium | 5.0 | 0% |
| CVE-2024-2368 | mollie-forms (WordPress plugin) | The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due | medium | 4.3 | 0% |
| CVE-2024-7386 | wpdm-premium-packages (WordPress plugin) | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to | medium | 4.3 | 0% |
| CVE-2024-8319 | tourfic (WordPress plugin) | The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to m | medium | 4.3 | 0% |
| CVE-2026-96379 | drupal/cookiecuttr | This module enables you to provide information and options about cookie usage. The module does not sufficiently filter | unknown | 0.0 | 0% |
| CVE-2024-11607 | gtpayment-donations (WordPress plugin) | The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escap | medium | 6.1 | 0% |